password_reset_token is now null when reset